1. Technical Field
The present disclosure relates to detection and removal of computer programs. More specifically, the present disclosure relates to restoring computer systems damaged by a malicious computer program.
2. Description of the Related Art
Computer viruses are a major problem in modem day computing. Generally, a computer virus is a program (or some unit of code, e.g., instructions to which the computer responds, such as a code block, code element or code segment) that may attach to other programs and/or objects, may replicate itself, and/or may perform unsolicited or malicious actions on a computer system. Although described herein as relating to computer viruses, the present disclosure may be applied to any type of malicious code capable of modifying one or more portions of a computer's resources. One cure for recovering from a computer virus may include removing the computer virus. This may include disabling the virus in an infected object, which may be, for example, a file, a memory area, or the boot sector of a storage medium. However, recent computer viruses have also been seen which manipulate objects in addition to the originally infected object, for example, by deleting or renaming files, manipulating system registry and initialization files, and/or creating unwanted services and processes.
Computer viruses have been seen that may rename an existing file on the computer system and/or replace it with a different file that causes the computer to operate in an undesirable manner. In addition, a virus may modify existing system configuration files while embedding itself in the computer system. An example of a computer virus that does both is the “Happy99.Worm” virus. This particular type of virus travels as an attachment to an email message and causes an infected computer to attach a copy of the virus to outgoing email messages. This type of virus may also place one or more hidden files on the computer's hard drive and/or make changes to the Windows registry file. For example, the “Happy99.Worm” virus renames the file “Wsock32.d11” to “Wsock32.ska” and replaces the original “Wsock32.d11” with its own version of the file. The “Happy99.Worm” virus also creates several other files on the computer system including “Ska.exe” and adds a line to the Windows registry file instructing the computer to run the “Ska.exe” file upon startup.
Simply disabling or removing the virus code without restoring or correctly renaming the files, etc., and/or removing unwanted services or processes, will not effectively restore the computer system. That is, restoring an object to which the virus has attached itself may not always be sufficient, particularly if a number of other objects have been created or modified by the computer virus.
Because each virus may affect different portions of a computer system, specific treatments are required and may require a number of operating system specific operations performed on any number of objects. Therefore, there is a need for a complete cure of an infected computer system that restores all the affected objects.